Transferring personal data out of Israel: when it is allowed and how to do it right

Adv. Arthur Kartun · 7 October 2026 · GDPR and the European Union

Personal data may be transferred from a database in Israel to another country in two ways. The first is where the law of the destination country protects the data at least as well as Israeli law does. The second is where one of eight cases listed in the regulations applies. Either way, the recipient must also give a written undertaking.

If your data sits with a cloud or SaaS provider in the US or Europe, in practice that means three things: a contract with each provider, a proper list of your providers, and a privacy notice that says the data is processed outside Israel.

The rule: protection no lower than Israel's

The starting point is a prohibition. Under Regulation 1 of the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001, you may not transfer data from a database in Israel to outside the country, or allow such a transfer, unless the law of the destination country ensures a level of protection no lower than Israeli law, with the necessary adjustments. In other words, the comparison is between the law there and the law here.

Eight cases in which a transfer is allowed

Even where the destination country's law does not meet that standard, Regulation 2 allows a transfer abroad if one of the eight cases it lists applies, in this order:

• The person the data is about has consented to the transfer.
• The person's consent cannot be obtained, and the transfer is necessary to protect their health or bodily integrity.
• The data is transferred to a corporation you control, and the protection of privacy after the transfer has been ensured. On its wording, this covers a corporation the transferor controls, not its parent company.
• The recipient has undertaken, in an agreement with you, to comply with the conditions for holding and using data that apply to a database in Israel, with the necessary adjustments.
• The data was made public, or opened to public inspection, under lawful authority.
• The transfer is necessary to protect public safety or security.
• Israeli law requires the transfer.
• The data is transferred to a database in certain countries: a country that is a party to the European convention on protecting individuals in the automatic processing of data, known as the Council of Europe's Convention 108; a country that receives data from the member states of the European Community on the same terms; or a country where, as the Registrar of Databases has announced in Reshumot, there is an authority whose role is to protect privacy and with which the Registrar has reached a cooperation arrangement.

A written undertaking for every transfer

In every transfer, whichever of the two ways it relies on, Regulation 3 requires you to obtain a written undertaking from the recipient. The recipient undertakes that it is taking sufficient measures to protect the privacy of the people the data is about, and that it will not pass the data to anyone else, whether in the same country or in another one.

But cloud providers usually rely on sub-processors, so the question of onward transfer comes up almost every time. Under an opinion of the Privacy Protection Authority of 13 October 2024, the bar on onward transfer does not apply if you, as the database owner in Israel, have consented to it in writing. That is subject to two conditions: the transfer to the third party would have been lawful had it been made within Israel, and it would have met the conditions of Regulation 1 or 2 had it been made directly from Israel. According to the same opinion, the undertaking may also include other accepted safeguards that are not identical to Israeli law, such as compliance with the GDPR. Bear in mind that this is the Privacy Protection Authority's interpretation, not the text of the regulations themselves.

Storing data in the cloud abroad: servers in the US or Europe

Data stored with a provider on servers outside Israel leaves Israel, so it needs a basis under one of the two ways. An opinion of the Privacy Protection Authority of 13 April 2026 refers expressly to transfers to a holder located outside Israel, that is, a provider processing the data on your behalf.

Where the servers are in the EU, the basis is usually the certain-countries case in Regulation 2(8), because every EU member state is a party to Convention 108. The US is not a party to the Convention, so with a commercial provider in the US the practical basis is usually an agreement under Regulation 2(4), in which the provider undertakes to comply with the conditions that apply to a database in Israel.

What the agreement with the provider must contain

Where the transfer relies on such an agreement, the opinion of 13 April 2026 sets out what it must contain. Again, this is the Privacy Protection Authority's interpretation, not legislation. Under it, the words “with the necessary adjustments” are an objective test. So the recipient's personal or organisational circumstances do not excuse it from the conditions. In the Privacy Protection Authority's words (our translation of the Hebrew original):

“An agreement for the transfer of personal data between a controller of a database in Israel and a party outside Israel must include an undertaking by the recipient of the data to fulfil, towards the data subjects, undertakings identical, or substantially similar in content, to those set out in the Israeli Privacy Protection Law.”

Among other things, the provider must undertake to use the data only for the purpose for which it was provided to you, to let people see the data about them and ask for it to be corrected or deleted, and to keep it confidential. It must also undertake the substantive duties in the Privacy Protection (Data Security) Regulations, 2017. As an alternative, it can hold ISO/IEC 27001 certification and also meet the requirements from the Data Security Regulations that the Privacy Protection Authority lists for that purpose in its Guideline 3/2018.

If the database also holds data that came from the European Economic Area, the provider must also undertake the substantive duties in Regulations 3–7 of the regulations on such data, which we cover in the next section. And note that relying on an agreement does not relieve you, or the provider, of your own duties under the Law and the regulations.

Data that came from the European Economic Area

Separate regulations, the Privacy Protection Regulations (Instructions for Data that was Transferred to Israel from the European Economic Area), 2023, apply to data in a database in Israel that came from the EU member states, Iceland, Norway or Liechtenstein. They do not apply to data that a person transferred directly about themselves. From 1 January 2025 they also apply to all other data in the same database.

These regulations add several duties. The first, in their Regulation 3, is deletion on request. A person may ask in writing for data about them to be deleted where it was collected unlawfully, where its continued use is unlawful, or where it is no longer needed for the purpose it was collected for. There are exceptions, and the decision must be given to the person in writing, as early as possible.

The second duty, in Regulation 4, is minimisation. You need a mechanism that makes sure the database does not keep data that is no longer needed, and that deletes it as early as possible. This does not apply if the data no longer allows the person to be identified by reasonable means, or if an exception applies.

The third duty, in Regulation 6, is notice. You must inform the person as soon as possible after you receive the data, and no later than one month after, either directly or through whoever transferred it to you. The notice says who the database owner and the database manager are and how to contact them, the purpose of the transfer, the type of data, and that the person has the right to see the data, correct it and ask for it to be deleted. If you want to pass the data to a third party, a further notice is needed, as early as possible and no later than the transfer. Here too there are exceptions.

The duties came into force in stages (Regulation 9). For data received from 7 August 2023 they apply from that day, for data received earlier they apply from 7 May 2024, and for the rest of the data in the same database from 1 January 2025.

If the data came from the EU, the onward-transfer rules of the GDPR, Europe's data protection law, may also apply to it. That can happen through the contract with the European customer or directly. We cover this in Does your company need GDPR compliance?

What should be in place

• An agreement or data processing agreement (DPA) with each provider abroad. It includes the written undertaking under Regulation 3. If the basis for the transfer is an agreement under Regulation 2(4), it also includes what the 2026 opinion sets out. And if the provider gets access to the database, it also includes what Regulation 15 of the Data Security Regulations requires in an agreement with an external party.
• A list of your providers. For each one, it is worth recording what data it receives, in which country the data is stored and from where it is accessed, which case in Regulation 2 the transfer relies on, and which sub-processors you have approved in writing.
• A privacy notice. Section 11 of the Privacy Protection Law, 1981 requires that when you ask a person for data, you tell them, among other things, “to whom the data will be delivered and the purposes of delivery”. The regulations on transferring data abroad do not require you to say that the data leaves Israel, but we recommend saying so. And if the transfer relies on the person's consent under Regulation 2(1), they need to know about it, otherwise their consent is not informed consent.

Contracts & Suppliers